[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[],[],null,["# Cloud KMS locations\n\nWithin a project, Cloud Key Management Service resources can be created in one of many\n[locations](/about/locations). These represent the geographical regions where\na Cloud KMS resource is stored and can be accessed. A key's\nlocation impacts the performance of applications using the key. Some resources,\nsuch as Cloud HSM keys, are not available in every location.\n\nKey material for Cloud KMS and Cloud HSM keys is confined\nto the selected region while at rest and in use.\n\nThe following tables list locations available for use in Cloud KMS\nfor different parts of the world. You can filter these locations by\n[location type](#location_types), Cloud HSM support, and\nCloud EKM support: \n**Filter by:** \nLocation type Show all Region Multi-region \nHSM support Show all Supports HSM \nEKM support Show all Supports EKM EKM by internet EKM by VPC\nClear all \n\n### Americas\n\n### Asia-Pacific\n\n### Europe, Middle East,\nand Africa\n\n^1^ Resources created in the `europe` multi-region are not stored in the `europe-west2` (London) or `europe-west6` (Zürich) data centers.\n\n### Worldwide\n\nTypes of locations for Cloud KMS\n--------------------------------\n\nYou can create Cloud KMS, Cloud HSM, and Cloud EKM\nresources in different types of locations in Google Cloud, depending on\nyour availability requirements. Locations are added regularly. For specific\ninformation about each location, see [Locations](/about/locations).\n\nYou can learn more about [choosing the best type of location](#choosing).\n\nThe following location types are available to Cloud KMS:\n\n- **Regional locations** : A regional location's data centers exist in a specific geographical place. For example, a resource created in the `us-central1` region is located in the central United States.\n- **Multi-regional locations** : A multi-regional location's data centers are spread across a large geographical area. For example, a resource created in the `europe` multi-region persists in multiple data centers within the European Union. You can't choose which data centers within the multi-region will contain your data.\n- **The global location** : The `global` location is a special multi-region. Its datacenters are spread throughout the world. You can't choose which data centers within the global multi-region will contain your data.\n\nChoosing the best type of location\n----------------------------------\n\nAs a rule, design your application so that all of its components are\ngeographically near each other and near your application's clients. The location\nof your keys is an important aspect of your application's design. After creation,\na key cannot be moved or exported.\n\nWhen using a multi-regional location, such as the `europe` multi-region,\nresources persist in multiple datacenters spread across the multi-region.\nCreating and updating keys in multi-regional locations, including the `global`\nlocation, might be less efficient than using a single-region location. For more\ninformation, see [Reading from and writing to multi-region locations](#multiregional_rw).\n\nUse the `global` location if all of the following are true:\n\n- Your application's components are distributed globally.\n- You have infrequent reads or writes but use other cryptographic operations frequently.\n- Your keys have no geographic residency requirements.\n- You aren't using external keys.\n\nFor Customer-Managed\nEncryption Keys (CMEK) integrations, you must use the same exact location as\nother resources related to the integration. Some CMEK integrations don't support\nthe `global` location. For more information about CMEK integrations, see\n[Customer-managed encryption keys (CMEK)](/kms/docs/cmek).\n\nCloud EKM resources rely on connectivity between Google Cloud and\nan external key management service, outside of Google Cloud. For\nCloud External Key Manager resources, select a location geographically as near as possible to\nthe location where keys are stored on the external key management service.\n\nCloud HSM depends on availability of physical hardware in a location's\ndatacenters. For Cloud HSM resources, select a location that supports\nCloud HSM.\n\nCloud HSM resources have location-specific [quotas](/kms/quotas).\nCloud KMS quotas are global.\n\nMulti-regional locations have separate quotas, independent of the\nquotas for single-region locations. For example, to create Cloud HSM\nresources in the `eur5` multi-region, you must have HSM quota in `eur5`, even if\nyou already have quota in the single regions that participate in `eur5`, such as\n`europe-west2`.\n\n### Reading from and writing to multi-region locations\n\nReading and writing resources or associated metadata in multi-regional\nlocations, including the `global` location, may be slower than reading or\nwriting from a single region.\n\n- When you create or read key versions, consensus is always required among the datacenters storing the key material. Reads and writes to a single region are often more efficient than those to a multi-regional location.\n- When you perform cryptographic operations, such as when encrypting or decrypting data, consensus is not required. For cryptographic operations, multi-regional locations perform similarly to single-region locations.\n- When you store your keys in a location or locations geographically near the data they protect or validate, cryptographic operations are usually more efficient.\n\nThe trade-offs between performance and availability are unique to each\napplication. Multi-region locations, including `global`, are best suited for\nread-heavy workloads.\n\nDetermining available regions\n-----------------------------\n\nYou can use the Google Cloud CLI or Cloud Key Management Service API to get a list of available regions. \n\n### gcloud\n\n```\ngcloud kms locations list\n```\n\nIn the output from the command, the `HSM_AVAILABLE` column indicates whether\nthe location supports Cloud HSM. The `EKM_AVAILABLE` column indicates\nwhether the location supports Cloud External Key Manager. **Note** that EKM via VPC keys\nare currently only available in regional locations.\n\n### API\n\nUse the\n[`Locations.get`](/kms/docs/reference/rest/v1/projects.locations/get) and\n[`Locations.list`](/kms/docs/reference/rest/v1/projects.locations/list)\nmethods.\n\nThe responses from both of these methods include boolean fields related to\na location's capabilities:\n\n- If a location supports Cloud HSM keys,\n [`hsmAvailable`](/kms/docs/reference/rest/v1/projects.locations#LocationMetadata.FIELDS.hsm_available)\n is `true`.\n\n- If a location supports Cloud EKM keys,\n [`ekmAvailable`](/kms/docs/reference/rest/v1/projects.locations#LocationMetadata.FIELDS.ekm_available)\n is `true`. **Note** that EKM via VPC keys are currently only available in\n regional locations.\n\nWhat's next\n-----------\n\n- Learn more about [Geography and regions](/docs/geography-and-regions) in Google Cloud.\n- See the full list of [Cloud locations](/about/locations)."]]
